December 2003 - cypherpunks-legacy

Question: DSA status and export requirements?
by doug＠openmind.com 17 Dec '03

17 Dec '03

Does anyone know if there have been any major developments in the DSA patent issue in the past year? I've read that some large companies have used DSA in products without paying royalties to Bizdos, but they also have separate licensing deals for RSA itself. On another note, I would much appreciate advice on whether a product which does only signature verification using, say, DSA and SHA, would require ITAR export approval? I've read that the NSA has specifically stated that they are not concerned with products that cannot be easily used for privacy -- so would such a product (which can verify but not generate signatures) even be required to apply for an export license? Doug Cutrell doug(a)OpenMind.com ________________________________________________ fuck the Exxon Communications Decency ammendment

1 0

Erroneous HPCwire phone #
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Whoops... Hope this helps! Cheers, Bob Hettinga --- begin forwarded text Date: Sat, 12 Aug 95 04:22:08 PST From: "Alan Beck" <alan(a)tgc.com> X-Minuet-Version: Minuet1.0_Beta_4 Reply-To: <alan(a)newsmaster.tgc.com> X-Popmail-Charset: English To: rah(a)shipwright.com Subject: Erroneous HPCwire phone # Robert, I can't reach my managing editor, who's a cypherpunk subscriber, so I'm emailing you: HPCwire's telephone number was posted incorrectly. Our real number is: 619-625-0070. I'd appreciate it if you could revise the post. Thanks much! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Alan Beck HPCwire Associate Editor 8445 Camino Santa Fe HPCwire Suite 204 alan(a)hpcwire.tgc.com San Diego, Calif. 92121 Voice: 619/625-0070 Fax: 619/625-0088 For a free trial subscription, email: <trial(a)hpcwire.tgc.com> ~~ Diagonally parked in a parallel universe. ~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: SSL challenge -- broken !
by Joe Buck 17 Dec '03

17 Dec '03

Congratulations on demonstrating the effort required to break SSL with a 40-bit key. It seems clear demonstrated that this is not adequate to store, say, company-confidential information for communication over insecure networks, since it seems the average grad student at a large university could get access to similar computing power that you used (spare cycles on a hundred workstations or more). However, I disagree with your conclusion: > Many people have access to the amount of computing power that I used. > The exportable SSL protocol is supposed to be weak enough to be > easily broken by governments, yet strong enough to resist the attempts > of amateurs. It fails on the second count. Don't trust your credit > card number to this protocol. Your credit card number, expiration date, etc, are continually being revealed to minimum-wage clerks all the time, unless you never use the card. A chain is only as strong as its weakest link; it makes no sense to buy an expensive lock when your door has a big enough opening to climb through. Should some bad person get hold of your card number and misuse it, you're not out any money: you just tell the card company "I didn't buy that". Since there's so much tracing in the system, if you buy a physical something with a stolen credit card number it can usually be traced to you (who'd they ship the package to?). It's not clear to me that *any* encryption is really essential if the only purpose is to protect credit card #'s from snoopers. There's plenty of stuff that *does* need protection, but I'm not sure credit card #'s head the list. Q: Of the 20,000 credit card #'s stolen from Netcom's computer, how many were used to buy things? Answer: not sure, but expect the answer is "zero".

2 1

Re: SSL challenge -- broken !
by goedel＠tezcat.com 17 Dec '03

17 Dec '03

Perry E. Metzger <perry(a)piermont.com> writes: >Joe Buck writes: >> However, I disagree with your conclusion: >> >> > Don't trust your credit card number to this protocol. >> >> Your credit card number, expiration date, etc, are continually being >> revealed to minimum-wage clerks all the time, unless you never use the >> card. > >On the other hand, those clerks can be traced down in most cases and >have fairly limited numbers of cards they get. It might be very >profitable to run a vacuum cleaner operation on the net slurping down >credit card number or other confidential information and then selling >it in bulk to people who could exploit it. Most credit card companies ship their registration information off shore to low tech developing countries. The idea is that the people entering the information are unlikely to be able to exploit the information they are exposed to. Capturing a set of credit card tapes is certainly profitable, as would be capturing large volumes of numbers, as you suggest. Now, are those West African credit fraud rings dialing up DEC, SUN, and SGI? :-) DJK P.S. There could be an article in tomorrows WSJ about the SSL Challenge. The technical details and facts will surely be mangled. :-(

1 0

Re: Object Oriented Crypto API
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

RC> anything without having to know anything about those formats at all. Yes. We need to be able to drop in new algorithms, because nobody knows what new attacks will be developed. RC> a Universal Resource Name (URN) for key identification. Perhaps RC> "key://keyserver.domain/keyid" would be better. Need to expand the concept of a key just a bit here. Your URL for keys needs to map to a hierarchy of keys that apply to different facets of a person's life, (casual vs. sensitive, personal vs. business) as well as to different encryption engines. The pubkey I have in the keyserver for the RSA algorithm will not work if you want to use the FOO algorithm instead. Rather than replicating the entire structure of keys for each new algorithm that comes along, there should be a standard protocol for requesting these various key types from the same "place". * I can't find where to put the milk in my "cereal" port. --- * Monster(a)FAmend.Com *

1 0

"the sovereign individual" by davidson/rees mogg
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

interesting new book out on the shelves, (c) 1997, by James Dale Davidson and Lord William Rees-Mogg called "the sovereign individual". many cpunk themes in this book and I highly recommend it to people on the list. from the back cover: they predict: - collapse of the welfare state and the death of nations worldwide - overhaul of the US Tax system, based on consumption instead of earnings - governments will lose power to arbitrarily regulate economies - banks will go through larger crisis than the 1980s - US government will diminish to the size it was in the 19th century - US government- IRS, CIA, NSA will declare war on groups that try to circumvent the income tax through cyberspace - organized crim ewill grow as central economies break down - central banks will lose power to inflate and control the money supply as paper money is supplanted by cybercash - individuals will gain more autonomy and financial capability - morality will make a comeback. interesting ideas on the role of violence in what makes different government and social systems "viable" and the idea as the government as being in the "protection" business with a monopoly on the use of violence. ideas about digital currencies that compete with each other on the free-market bases. inviability of the "new world order" of worldwide government. lots of neat ideas on cyberspace. role of cryptography in securing private transactions. from p. 324, on cyberspace: "massed armies will mean little in such a world. efficiency will mean more than ever before. because microtechnology creates a new dimension in protection, individuals for the first time in human existence will be able to create and protect assets that lie entirely outside the realm of any individual government's territorial monopoly on violence. these assets, therefore, will be highly susceptible to individual control. it will be perfectly reasonable for you and significant numbers of future Sovereign Individuals to "vote with your feet" in opting out of leading nation-states to contract for personal protection with an outlying nation-state or a new minisovereignty that will only charge a commercially tolerable amount, rather than the greater part of your net worth." an interesting theme near the end of the book is the idea that morality/trust will play a more important role in cyberspace because people will be depending on each other's reputations to conduct business transactions in cyberspace. some of these ideas I've written on here before, and seen much dialogue here. think this will be an influential book that will frame future debate for a long time. the authors verge on what consider "conspiracy theory" at times when they even get into Clinton's drug connections in mena, arkansas. they advocate going to alternative sources of news other than the mass media which will be unable to recognize or report on the reality of the changing world because they are caught up in their own reality distortion fields, very much like those who, at the fall of the roman empire, still believed it existed.

1 0

genetic software patents (fwd)
by Brad Dolan 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Sometime ago, I reported on a recent discovery of how gene sequences can be used for mathematical optimization calculations. The method, developed by Leonard Adelman (the "A" of RSA) provided a way of solving the Traveling Salesman Problem using gene sequences (interestingly, the paper by Hopfield that kicked off the neural network revival also solved the TSP). Computable genes blurs even more hardware and software (along with hardware/software codesign tools), but has yet to sink into PTO statutory and prior art thinking. In any event, the August 1995 issue of Dr. Dobb's Journal, page 127, has a nicely illustrated article titled "Biochemical techniques take on combinatorial problems". If you or your clients are interested in this new form of computing, get a copy of the article. Adelman's original paper titled "Molecular Computation of Solutions to Combinatorial Problems" and was in the November 11, 1994 issue of Science. While you are at it, get a copy of an article that appeared in the July 27, 1995 issue of Nature, page 307, titled "Protein molecules as computational elements in living cells". It starts out "Many proteins in living cells appear to have as their primary function the transfer and processing of information, rather than chemical transformation of metabolic intermediates or the building of cellular structures". Yet one more blur or "hardware" and "software". Geneware? A final article to get is "Circuit simulation of genetic networks", appearing in the August 4, 1995 issue of Science, page 650. It proposes to simulate genetic networks (such as the bacteriophage lambda lysislysogeny decision circuit) using the tools found in hardware/software codesign tools. With VHDL as a digital circuit language, and AHDL as a analog circuit language, are we going to need GHDL as a genetic circuit language? It is not hard to imagine in the future some VHDL code being mapped into software with standard translators, into hardware using cell libraries, and into gene sequences using sequence libraries interface to EDA design tools. Properly structured sets of claims under the Doctrine of Equivalents could claim coverage in all types of domains (in fact, the claims could be generated by the design tool itself using a "cell" library of claim clauses). Alternatively entire libraries of medical journals suddenly become potential software/hardware prior art. While practical use of the gene technique is years off, it does raise the issue of how the PTO is going to handle the prior art aspects, when gene technology now becomes software and hardware prior art (as soon as, if ever, the PTO first solves the software-software prior art problem, and then the software/hardware codesign prior art problem). Scientists are blurring the lines of computing much faster than the PTO can respond; for example, the proposed software patent guidelines reflect none of the above developments. Together these three papers represent the cutting cutting edge of issues that will be affecting the patenting world in the years to come. Read them now to get a jump.

1 0

Re: FBI Files on Clipper Release
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Futplex <futplex(a)pseudonym.com> writes: <FBI document excerpt obtained through FOIA snipped> >...meanwhile... <Directly contrary Senate Judiciary Subcommittee testimony by Assistant Attorney General Jo Ann Harris also snipped> >By exactly what mechanism are appointed (hired ?) officials such >as AAG Harris supposedly accountable to the public ? Supposedly, the congressional pur$e-$trings... [I doubt the "reformers" will exercise this power.] >Can they be brought up on perjury charges ? [I *wish* but...] doubtful, our best hope is the media. >Just what real legal recourse do we have against lying >scum in the bureaucracy ? I have mass-forwarded Dave Banisar's post to all the media e-mail addresses I have. I suggest that everyone on the list do this too. [Isn't e-mail wonderful? :) ] I also e-mailed the government asking which position was the lie, but I don't expect a response. >Are we stuck unless we can get some Congresscritter to cry >foul on the floor of the House or Senate ? Yup. I'm afraid our best hope [aside from the media] is Congressman Trafficant and his ilk. ;-) <snip> >"you said too much; and what you said, it was a lie" -EMF When combined with PRZ's award today, I feel this obvious lie could be a blessing in disguise for us privacy lovers. I say this in view of the timing of the upcoming political season, but everyone here already knows that I only trust one kind of candidate to tell us the truth. Now they know why... JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMDKYp21lp8bpvW01AQFVggP+PqD6KaxwTYLogOaPC4G7nEzqfnR7sfyc SXQx4rQFt+HoaDbo89k75jh8BcfCwmZNEXsmbIz7ilyiIcnwhLDLL+sL+ZPie25W autacym9+MXjrkQUu12qNxQ+XKH0y+TR/mMCGIUVxtpyT5QMPVtAptS1DScoJx0U 0LmFsuSM+Z8= =C1JX -----END PGP SIGNATURE----- Regards, Jim Ray Don't investigate Mena, Arkansas and contra-coke. Embarrassment is a threat to national security... ------------------------------------------------------------------------ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 ------------------------------------------------------------------------ Support the Phil Zimmermann (Author of PGP) Legal Defense Fund! email: zldf(a)clark.net or visit http://www.netresponse.com/zldf ________________________________________________________________________

1 0

Re: NSA leak (fwd)
by Secret Squirrel 17 Dec '03

17 Dec '03

Subject: Re: NSA leak (fwd) Ian Goldberg <iang(a)cs.berkeley.edu> writes: > 2. Their cracker changes the state of 2^128 bits in 33 minutes. This is > being extremely generous; > (Actually, for all I know, terawatt power sources > may exist; that's out of my field. Please let me know if this is the case. Not within a few million miles of here, and they'd be hard to conceal. A few GW is fairly easy, by several methods. Terrestrial fusion is not a serious contender yet, and I doubt it will be for a long time. > 3. They have a quantum computer, or some alien technology, or something > else we know pretty much nothing about. > Given this choice, I would vote for #3. :-) However, I'd go out on a limb > and say that the NSA guy was simply lying (or that the anecdote itself is > mistaken). I agree. The 'something else' could be info about RNG flaws I suppose. This guy couldn't be thinking about DES could he ?

3 2

Re: SSL challenge -- broken !
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Joe Buck writes: <snip> >Your credit card number, expiration date, etc, are continually being >revealed to minimum-wage clerks all the time, unless you never use the >card. A chain is only as strong as its weakest link; it makes no sense to >buy an expensive lock when your door has a big enough opening to climb >through. Should some bad person get hold of your card number and misuse >it, you're not out any money: I'm not so sure....Checked the fees/interest lately? "There ain't no such thing as a free credit card theft." [Apologies to Milton & Rose Friedman.] ;) >you just tell the card company "I didn't buy >that". Since there's so much tracing in the system, if you buy a physical >something with a stolen credit card number it can usually be traced to you >(who'd they ship the package to?). They only *sometimes* find the person/loot. >It's not clear to me that *any* >encryption is really essential if the only purpose is to protect credit >card #'s from snoopers. OK, but I had an idea a number of years ago. It's not too new, either, and considering the BILLION$ in credit-card fraud, I think the credit card companies could implement it with little trouble at every site the cards are used. Why not PIN numbers. Banks and their customers are already used to them, they could be entered over the phone (I know, not too secure) or in person, and considering the dollar ammount of the current fraud, they would be cheap (I think). [There is probably a flaw in my idea, but I haven't found it.] <snip> >Q: Of the 20,000 credit card #'s stolen from Netcom's computer, how many >were used to buy things? Answer: not sure, but expect the answer is "zero". Probably so, but imagine being a Netcom customer (or a Netcom stockholder). Not all of the costs of crime are monetary. JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMDKdH21lp8bpvW01AQGBTwP/VQ7BNPAAna6ba3avp+y9us0E5hhpUGdJ 6shHmZjPDWrSZz9aGzq5xhkQzSKdlLy/lFePt8acFBbDaGnK8wzAvoo1S69mr4bA AUJ+IsI5j/Ctvic0RGbiIlfy+thXna6iwTgDovBB7u311+UMCgMg0A89onIjWCQQ jKN2sSimEHg= =0TzV -----END PGP SIGNATURE----- Regards, Jim Ray Don't investigate Mena, Arkansas and contra-coke. Embarrassment is a threat to national security... ------------------------------------------------------------------------ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 ------------------------------------------------------------------------ Support the Phil Zimmermann (Author of PGP) Legal Defense Fund! email: zldf(a)clark.net or visit http://www.netresponse.com/zldf ________________________________________________________________________

2 1